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TM THE CLAIMS 



Amended claims follow: 



0- 



1 . (Currently Amended) A metliod of detecting computer viruses within a computer 
file, said method composing the steps of: 

receiving a request to scan a computer file for computer viruses; 

initiating a virus scanning operation upon said computer file; 

calculating during said virus scanning operation a measurement value indicative 
of an amount of data processing performed during said virus scanning operation^ 
wherein the measurement value is based, at least in part , on at least one of a data size of 
the computer file and a complexity of tests of the virus s canning operation; 

comparing during said virus scanning said measurement value with a threshold 
value; and 

triggering a break in said virus operation prior to completion of the tests to 
determine as to whether the computer file is infected, if i ^said measurement value 
exceeds said threshold value to prevent overload of a virus scanner . 



2. (Original) A method as claimed in claim 1, fiirther comprising the step of, upon 
occurrence of said break, determining using said measurement value whether or not said 
virus scanning operation should be terminated prior to completion. 

3. (Original) A method as claimed in claim 1, wherein said measurement value 
yields a processed data size value for data processed during said virus scanning 
operation. 



4. (Original) A method as claimed in claim 1, wherein said amount of data 
processing performed includes data processing involved in any decompression of said 
computer file required for said virus scanning operation. 
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5. (Original) A method as claimed in claim 1 , wherein said amount of data 
processing performed includes data processing involved in any unpacking of said 
computer file required for said virus scanning operation. 

6. (Original) A method as claimed in claim 2, wherein said measurement value 
yields a processed data size value for data processed during said virus scanning 
operation and step of determining is responsive to both said processed data size value 
and a computer file size value for said computer file when determining whether or not 
said virus scanning operation should be terminated prior to completion. 

7. (Original) A method as claimed in claim 6, wherein said step of determining 
calculates a measurement ratio of siiid processed data size value to said computer file 

Or' size value and compares this with a termination size threshold ratio such that said virus 
^^J^ scanning is terminated if said measurement ratio exceeds said temiination size threshold 

ratio. 

8. (Currently Amended) A method as claimed in claim 1, wherein said virus 
scanning operation applies a plurality of the tests to said computer file, each test having 
a complexity value indicative of an amount of data processing associated with that test 
and said measurement value is a sum of complexity values for tests applied during said 
virus scanning operation. 

9. (Original) A method as claimed in claim 8, wherein said plurality of test applied 
are selected in dependence upon said computer file. 

1 0. (Currently Amended) A method is claimed in claim 2, wherein said virus 
scanning operation applies a plurality of the tests to said computer file, each test having 
an complexity value indicative of an amount of data processing associated with that test, 
said measurement value being a sum of complexity values for tests applied during said 
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virus scanning operation and said step of determining terminating said virus scanning 
operation prior to completion if said sum of complexity values exceeds a termination 
complexity threshold value. 

1 1 . (Currently Amended) Apparatus for detecting computer viruses within a 
computer file, said apparatus comprising: 

a receiver operable to receive a request to scan a computer file for computer 

viruses; 

initiating logic operable to initiate a virus scanning operation upon said 
computer file; 

calculating logic operable to calculate during said virus scanning operation a 
measurement value indicative of an amount of data processing performed during said 
virus scanning operatio n, wherein the measurement value i s based, at least in part, on at 
least one of a data size of the computer file and a complexity of tests of t he virus 
scanning operation : 

comparing logic operable during said virus scanning to compare said 
measurement value with a threshold value; and 

triggering logic operable to trigger a break in said virus operation prior to 
completion of the tests to determine as to whether the computer file is infected if is-said 
measurement value exceeds said threshold valu e to prevent overl oad of a virus scanner. 

12. (Original) Apparatus as claimed in claim 1 1 , wherein, upon occurrence of said 
break, determining logic operates using said measurement value to determine whejJier 
or not said virus scanning operation should be terminated prior to completion. 

13. (Original) Apparatus as claimed in claim 1 2, wherein said measurement value 
yields a processed data size value for data processed during said vims scanning 
operation. 

14. (Original) Apparatus as claimed in claim 11, wherein said amount of data 
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processing performed includes data processing involved in any decompression of said 
computer file required for said virus scanning operation. 

15. (Original) Apparatus as claimed in claim 1 1, wherein said amount of data 
processing performed includes data processing involved in any unpacking of said 
computer file required for said virus scanning operation. 

16. (Original) Apparatus as claimed in claim 12, wherein said measurement value 
yields a processed data size value for data processed during said virus scanning 
operation and said determining logic is responsive to both said processed data size value 
and a computer file size value for said computer file when determining whether or not 
said virus scanning operation should be terminated prior to completion. 

17. (Original) Apparatus as claimed in claim 1 6, wherein said determining logic is 
operable to calculate a measurement ratio of said processed data size value to said 
computer file size value and compare this with a termination size threshold ratio such 
that said virus scanning is terminated if said measurement ratio exceeds said termination 
size threshold ratio. 

1 8. (Currently Amended) Apparatus as claimed in claim 1 1 , wherein said virus 
scanning operation applies a plurality of the tests to said computer file, each test having 
afl complexity value indicative of an amount of data processing associated with that test 
and said measurement value is a sum of complexity values for tests applied during said 
virus scanning operation. 

19. (Currently Amended) Apparatus as claimed in claim 18, wherein said plurality 
of tests applied are selected in dependence upon said computer file. 

20. (Currently Amended) Apparatus as claimed in claim 12, wherein said virus 
scanning operation applies a plurality of the tests to said computer file, each test having 
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aft complexity value indicative of aji amount of data processing associated with that test, 
said measurement value being a sum of complexity values for tests applied during said 
virus scanning operation and said step of determining terminating said virus scanning 
operation prior to completion if said sujn of complexity values exceeds a termination 
complexity threshold value. 

2 1 . (Currently Amended) A computer program product carrying a computer 
program for controlling a computer to detect computer viruses within a computer file, 
said computer program comprising: 

receiver code operable to receive a request to scan a computer file for computer 

viruses; 

initiating code operable to initiate a virus scanning operation upon said computer 

file; 

calculating code operable to calculate daring said virus scanning operation a 
measurement value indicative of an amount of data processing performed during said 
virus scanning operation , wherein the measurement value is based, at leas t in part, on at 
least one of a data size of the computer file and a complexity of tests o f the virus 
scanning operation ; 

comparing code operable during said virus scanning to compare said 
measurement value with a threshold value; and 

triggering code operable to trigger a break in said virus operation prior to 
completion of the tests to determine as to whether the computer file is infected, if t s-said 
measurement value exceeds said threshold value to prevent overload of a virus scanner . 

22. (Original) A computer program product as claimed in claim 21, wherein, upon 
occurrence of said break, determining code operates using said measurement value to 
determine whether or not said virus scanning operation should be terminated prior to 
completion. 

23. (Original) A computer program product as claimed in claim 22, wherein said 
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measurement value yields a processed data size value for data processed during said 
virus scanning operation. 

24. (Original) A computer program product as claimed in claim 21 , wherein said 
amount of data processing performed includes data processing involved in any 
decompression of said computer file required for said virus scanning operation. 

25. (Original) A computer program product as claimed in claim 21 , wherein said 
amount of data processing performed includes data processing involved in any 
unpacking of said computer file required for said virus scanning operation. 

26. (Original) A computer program product as claimed in claim 22, wherein said 
measurement value yields a processed data size value for data processed during said 
virus scanning operation and said determining code is responsive to both said processed 
data size value and a computer file size value for said computer file when determining 
whether or not said virus scanning opei ation should be terminated prior to completion, 

27. (Original) A computer program product as claimed in claim 26, wherein said 
determining code is operable to calculate a measurement ratio of said processed data 
size value to said computer file size value and compare this with a termination size 
threshold ratio such that said virus scanning is terminated if said measurement ratio 
exceeds said termination size threshold ratio. 




28. (Currently Amended) A computer program product as claimed in claim 21, 
wherein said virus scanning operation applies a plurality of the tests to said computer 
file, each test having as complexity value indicative of an amount of data processing 
associated with that test and said measurement value is a sum of complexity values for 
tests applied during said virus scanning operation. 

29. (Currently Amended) A computer program product as claimed in claim 28, 
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wherein said plurality of the tests applied are selected in dependence upon said 
computer file. 

30. (Currently Amended) A computer program product as claimed in 22, wherein 
said virus scanning operation applies a plurahty of the.tests to said computer file, each 
test having aa complexity value indicative of an amount of data processing associated 
with that test, said measurement value being a sum of complexity values for tests 
appKed during said virus scanning operation and said step of determining terminating 
said virus scanning operation prior lo completion if said sum of complexity values 
exceeds a termination complexity tlueshold value. 
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